CVE-2022-24980

HIGH

Kitodo.Presentation < 2.3.2 - Unauthenticated Server-Side Request Forgery via eID Script

Title source: llm

Description

An issue was discovered in the Kitodo.Presentation (aka dif) extension before 2.3.2, 3.x before 3.2.3, and 3.3.x before 3.3.4 for TYPO3. A missing access check in an eID script allows an unauthenticated user to submit arbitrary URLs to this component. This results in SSRF, allowing attackers to view the content of any file or webpage the webserver has access to.

References (2)

Core 2

Core References

Vendor Advisory x_refsource_misc

https://typo3.org/help/security-advisories

Vendor Advisory x_refsource_confirm

https://typo3.org/security/advisory/typo3-ext-sa-2022-001

Scores

CVSS v3 7.5

EPSS 0.0118

EPSS Percentile 63.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-918

Status published

Products (2)

kitodo/kitodo.presentation < 2.3.2

kitodo/presentation 0 - 2.3.2Packagist

Published Feb 19, 2022

Tracked Since Feb 18, 2026